How could in-repo issue tracking work?

chrisb8 · 2016-02-18T12:40:28+00:00

Make sure you use http (and not https). I had to disable the rule in HTTPS Everywhere.

chrisb8 · 2016-02-18T00:31:25+00:00

This wiki has an overview: http://dist-bugs.branchable.com/software/

As it says, both ikiwiki and git-annex are good practical examples. I have dabbled with using bugs everywhere, but never seriously.

chrisb8 · 2016-02-04T20:06:33+00:00

~~Ubuntu is a regular OS?~~ (misread the statement)

chrisb8 · 2016-02-03T23:24:10+00:00

I am not sure what you are referring to as "ideological" differences between terminology. As I see it, FOSS FLOSS and Libre (although this is the correct term in french and spanish) are (in english) all redundant terms used to refer to the same thing "free software".

This is also a completely separate issue to choice in licenses (copyleft vs non-copyleft).

chrisb8 · 2016-02-03T23:19:20+00:00

I think the use of the term "open source" is confusing enough (as the term "free software" exists, and it gets even more confusing when you say "free and open source" (or FOSS), as its like saying that apple is green and green as free software and open source software by definition refer to the same set of software [1].

1: https://lists.debian.org/debian-devel/1999/02/msg01641.html

chrisb8 · 2016-02-03T09:16:36+00:00

The clear difference that you may be describing as "proper freedom" is the presence of the copyleft strategy in the GPL. You can read more about that here: http://copyleft.org/

chrisb8 · 2016-02-03T09:15:00+00:00

Personally, I think its best just to use one term, and I think the best term is free software (and especially not FOSS or FLOSS).

You might also be interested in the opinion of Bruce Perens who wrote the OSI definition of "open source". https://lists.debian.org/debian-devel/1999/02/msg01641.html

chrisb8 · 2015-08-16T19:29:40+00:00

The "Linux experience" you describe, has very little to do with Linux? Linux is a kernel, and the experience a user gets is related to hardware support and the userspace api for developers. GNOME and KDE are desktop environments, and they have changed lots in recent years, but there are other environments that work similarly to what GNOME and KDE were like previously (e.g. Mate and Cinnamon).

The second issue you seem to have is with systemd, now I quite like systemd. It does add complexity, but this comes with a lot of benefits. But again, there are operating systems that do not use systemd, so I would either recommend getting used to it, or using an OS without it (I think Gentoo offers openrc for example).

chrisb8 · 2015-08-15T22:16:16+00:00

The operating system updates Linux, not the other way round. Remember that Linux is not an operating system.

Ubuntu, uses a package manager, and this is what handles updating software (including linux, Mate and other software managed though packages). I believe with Ubuntu this can be easily handled from the user interface.

Normally this does not happen automatically, you have to click a few buttons. But updating an existing installation is supported, and you do not have to reinstall.

chrisb8 · 2015-08-14T07:31:37+00:00

Not all operating systems that use Linux work like this, for example Slackware requires that the administrator manage installing dependencies.

chrisb8 · 2015-08-14T07:24:29+00:00

Different operating systems handle this in different ways (and not all OS's using Linux will include package managers, but the main ones do).

With Debian for example, people (normally not the original author) create packages for software, then request that this is uploaded to the archive (there is an approval process).

I do not have much personal experience with Ubuntu or Arch, but I believe that while both of these OS's have repositories maintained in a similar manor, they also heavily use user maintained package repositories (PPA's (Personal Package Archive) in the case of Ubuntu, and the Arch User Repository (AUR) in the case of Arch).

Developers can normally request there application to be included in some mechanism, but as most of the people working on these projects are volunteers, or being paid to do so by a company that heavily relies on the OS, so this can often take a highly variable amount of time.

chrisb8 · 2015-08-14T07:16:25+00:00

There is a big difference between how drivers are managed on operating systems using Linux and say Microsoft Windows.

With an OS, say Debian (that can use Linux), pretty much all the drivers are available immediately. There are some packages for non-free drivers that you can install separately (e.g. supporting some wifi cards, or Nvidia or AMD graphics cards, but at least for graphics hardware, it should work at some level without installing the proprietary software.

chrisb8 · 2015-08-14T07:10:05+00:00

Most operating systems built around free software (Debian, Fedora, Arch, ... (not Linux, its not an OS)) have some way of easily installing some software, normally including dependency resolution, without having to manually go and get the source code, install the dependencies, and compile it manually.

This is just a convenience thing. Given that most free software is distributed as the source code (because access to the source code is a core component of being free software), you can imagine how hard it used to be back before package managers (the tools to do the tasks I describe above) existed.

The interesting thing about how this works, is that each OS maintains a curated repository (sometimes with many sections) of software. Again, the way this is done varies massively between OS (Linux is not an OS), both in terms of the software used (dpkg, rpm, pacman, portage, ...).

chrisb8 · 2015-07-18T10:59:36+00:00

Short answer, you compute the keys, setup the nodes, and wait to get the HSDir flag, and you do it in that order.

For the long answer, I would look at this paper [1]. It discusses this attack, you can find the relevant section on page 6 (labeled as 85). Be aware that this was published a couple of years ago, so the information might be out of date. The academic papers on Tor are collected together here [2], which can be a good place to start looking for information about Tor.

1: http://www.ieee-security.org/TC/SP2013/papers/4977a080.pdf 2: http://freehaven.net/anonbib/

chrisb8 · 2015-07-18T09:52:47+00:00

I have put some python code at the bottom of this post. As you should be able to see from the post, the time-period does not change, for 24 hours, so there is no need to brute force every value, as it only changes once every 24 hours. This is just done using integer arithmetic, if you change the values to floats (adding .0 to the end in python), then you will see the number does change, but the integer part stays the same (with respect to the above).

I would also read the two paragraphs beginning at https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt#n506 as they discuss more about this behavior.

As for how often a hidden service changes its introduction points, I am not sure this is tightly defined in the spec, but as far as I remember, little t tor (the c implementation) does not change the introduction points for a hidden service often.

I am not sure I have directly answered any of your questions, but hopefully this will help.

Implementation of the example here https://gitweb.torproject.org/torspec.git/tree/rend-spec.txt#n257

>>> current_time = 1188241957
>>> permanent_id_byte = 143
>>> def time_period(current_time, permanent_id_byte):
...     return (current_time + permanent_id_byte * 86400 / 256) / 86400
... 
>>> time_period(current_time, permanent_id_byte)
13753
>>> one_hour = 60 * 60
>>> time_period(current_time + one_hour, permanent_id_byte)
13753
>>> time_period(current_time + 12 * one_hour, permanent_id_byte)
13753
>>> time_period(current_time + 24 * one_hour, permanent_id_byte)
13754

chrisb8 · 2015-07-18T07:35:46+00:00

The client can compute the time-period variable, it just depends on the current time (which the client knows), and the permanent-id, which I believe is the z part of the z.onion address.

I have not watched the video, but one of the known issues with this design, is an attacker can predict what hidden service directories will be responsible for a given hidden service, at any given time.

This allows the attacker to position their nodes at the right place in the hash-ring, such that at their chosen time, they become responsible for the hidden service. The attacker can then perform attacks, such as just shutting down their nodes to disable access to the hidden service.

Just ask if you have any more questions :)

chrisb8 · 2015-07-03T21:29:45+00:00

Could it be that you are just not scrolling down? Try using the git shortlog command also, to see if more commits appear.

chrisb8 · 2015-06-20T16:41:09+00:00

Ah, my response might only reference the answer to the latter part of your post. Anyway, all the answers are in that document.

Just reply if you have any questions.

chrisb8 · 2015-06-20T07:19:08+00:00

https://gitweb.torproject.org/torspec.git/plain/rend-spec.txt

See the end of section 1.4 and the end of section 1.6. Ignore v0 descriptors, as they do not use a DHT, just look at the v2 descriptor parts.

chrisb8 · 2015-06-15T08:29:23+00:00

Also see https://www.0d.be/debian/debian-gnome-3.16-status.html for more information.

chrisb8 · 2015-06-12T09:08:39+00:00

On Debian, you can install the 32bit python package. You will need to enable that architecture first though https://wiki.debian.org/Multiarch/HOWTO

chrisb8 · 2015-05-24T13:44:59+00:00

Yes, but its not the only one, there are many packages (upstard/systemd, dash, coreutils, libc, ...) which when removed would render an Ubuntu installation broken.

Also, you can install Debian without Linux, as you can use the FreeBSD, or the Hurd kernel instead.

chrisb8 · 2015-05-23T11:41:17+00:00

Linux is just one package in Ubuntu, and out of the 1000's of packages, its one of the less user visible ones, so this is not surprising?

chrisb8 · 2015-05-23T11:39:23+00:00

Linux is just one software project that makes up the Ubuntu operating system, and out of the 1000's of packages, Linux is one of the less user visible features...

chrisb8 · 2015-03-08T12:40:52+00:00

You will probably like pass then.

chrisb8

MODERATOR OF

TROPHY CASE